A communication system is a facility that enables communication between two or more entities such as user terminal equipment and/or network entities and other nodes associated with a communication system. The communication may comprise, for example, communication of voice, electronic mail (email), text messages, data, multimedia and so on.
The communication may be provided by fixed line and/or wireless communication interfaces. A feature of wireless communication systems is that they provide mobility for the users thereof. An example of a communication system providing wireless communication is a public land mobile network (PLMN). An example of the fixed line system is a public switched telephone network (PSTN).
A cellular telecommunication system is a communications system that is based on the use of radio access entities and/or wireless service areas. The access entities are typically referred to as cells. Examples of cellular telecommunication standards include standards such as GSM (Global System for Mobile communications), GPRS (General Packet Radio Servers), AMPS (American Mobile Phone System), DAMPS (Digital AMPS), WCDMA (Wideband Code Division Multiple Access), UMTS (Universal Mobile Telecommunication System) and CDMA 2000 (Code Division Multiple Access 2000).
A communication system typically operates in accordance with a given standard or specification which sets out what the various elements of a system are permitted to do and how that should be achieved. For example, the standard of specification may define if the user, or more precisely user equipment is provided with a circuit switched service of a packet switched service or both. Communication protocols and/or parameters which should be used for the connection are also typically defined. For example, the manner in which communication shall be implemented between the user equipment and the elements of the communication network is typically based in a predefined communication protocol. In other words, a specific set of “rules” on which the communication can be based needs to be defined to enable the user equipment to communicate via the communication system. Typically, given standards will also define how authentication and authorisation mechanisms as well as how accounting systems should work.
Certain authentication methods are known for allowing the user of a mobile station to authenticate himself to a service provider, or for example for remotely accessing corporate information systems. One way to authenticate corporate user is to authenticate him based on the same password that he is using for logging into the corporate network within the corporate premises. For example, a VPN connection is typically established using the IKE protocol, and Internet based authentication schemes such as HTML Forms and HTTP Digest can be used to obtain corporate network login and password from the user. These methods require that the user knows the password. However, these methods have the problem that the username and password of the user may have been illegitimately obtained by observing the user while the user is logging in, or via other routes.
A stronger security model requires the use of an item the user has in addition to something the user knows. For example, the item can be a physical key, a smart card, or a device. One such device is the SecurID device manufactured by the RSA Security Corporation. A SecurID device has an accurate internal clock, and displays access codes. These access codes are dependent on time and initialization information within the SecurID device.
However, even that solution has certain drawbacks. It is inconvenient for the user to take care that the device is with him when it is needed. The user may need to remember another PIN (personal identification number), in case the device requires input of a PIN. The access code provided by the device is valid for only a rather short time, which is too inflexible for certain use cases. For example, a travelling user may have no good network connection and the network delays may cause authentication failures due to time-out of the access code. Also, purchasing these devices for each user may be expensive for an organization.
Another solution which would provide a second authentication factor in addition to knowing a password would be installing a secret in a station, such as a mobile station, of the user and using that secret as a factor in the authentication. Modern mobile stations have a smart card such as an UICC (UMTS IC Card) for storing subscription information. Thus, the secret could be stored in the UICC.
However, this solution also has certain drawbacks. This solution would require purchasing special UICC:s from the mobile network operator, and obtaining such UICC:s for the whole organization may cost a substantial sum of money. Moreover, an employee might be required to use a new telephone number if he changes his UICC.